Skip to content
CHANGES 168 KiB
Newer Older
Christophe Jaillet's avatar
Christophe Jaillet committed
  *) mod_include: Use new ap_expr for 'elif', like 'if', 
     if legacy parser is not specified.  PR 54548 [Tom Donovan]
  *) mod_lua: Add some new functions: r:htpassword(), r:mkdir(), r:mkrdir(),
     r:rmdir(), r:touch(), r:get_direntries(), r.date_parse_rfc().
     [Guenter Knauf]

  *) mod_lua: Add multipart form data handling. [Daniel Gruno]

  *) mod_lua: If a LuaMapHandler doesn't return any value, log a warning
     and treat it as apache2.OK. [Eric Covener]

  *) mod_lua: Add bindings for apr_dbd/mod_dbd database access
     [Daniel Gruno]

  *) mod_lua: Add LuaInputFilter/LuaOutputFilter for creating content
     filters in Lua [Daniel Gruno]

  *) mod_lua: Allow scripts handled by the lua-script handler to return
     a status code to the client (such as a 302 or a 500) [Daniel Gruno]

  *) mod_lua: Decline handling 'lua-script' if the file doesn't exist,
     rather than throwing an internal server error. [Daniel Gruno]

  *) mod_lua: Add functions r:flush and r:sendfile as well as additional
     request information to the request_rec structure. [Daniel Gruno]

  *) mod_lua: Add a server scope for Lua states, which creates a pool of
     states with managable minimum and maximum size. [Daniel Gruno]

  *) mod_lua: Add new directive, LuaMapHandler, for dynamically mapping
     URIs to Lua scripts and functions using regular expressions.
     [Daniel Gruno]

  *) mod_lua: Add new directive LuaCodeCache for controlling in-memory
     caching of lua scripts. [Daniel Gruno]

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.4
  *) SECURITY: CVE-2012-3499 (cve.mitre.org)
     Various XSS flaws due to unescaped hostnames and URIs HTML output in
William A. Rowe Jr's avatar
William A. Rowe Jr committed
     mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.
     [Jim Jagielski, Stefan Fritsch, Niels Heinen <heinenn google com>]

  *) SECURITY: CVE-2012-4558 (cve.mitre.org)
     XSS in mod_proxy_balancer manager interface. [Jim Jagielski,
     Niels Heinen <heinenn google com>]

Rainer Jung's avatar
Rainer Jung committed
  *) mod_dir: Add support for the value 'disabled' in FallbackResource.
     [Vincent Deffontaines]
  *) mod_proxy_connect: Don't keepalive the connection to the client if the
     backend closes the connection. PR 54474. [Pavel Mateja <pavel netsafe cz>]

  *) mod_lua: Add bindings for mod_dbd/apr_dbd database access.
     [Daniel Gruno]
  *) mod_proxy: Allow for persistence of local changes made via the
     balancer-manager between graceful/normal restarts and power
     cycles. [Jim Jagielski]

  *) mod_proxy: Fix startup crash with mis-defined balancers.
     PR 52402. [Jim Jagielski]

  *) --with-module: Fix failure to integrate them into some existing
     module directories.  PR 40097.  [Jeff Trawick]

Joe Orton's avatar
Joe Orton committed
  *) htcacheclean: Fix potential segfault if "-p" is omitted.  [Joe Orton]

  *) mod_proxy_http: Honour special value 0 (unlimited) of LimitRequestBody
     PR 54435.  [Pavel Mateja <pavel netsafe.cz>]

Rainer Jung's avatar
Rainer Jung committed
  *) mod_proxy_ajp: Support unknown HTTP methods. PR 54416.
     [Rainer Jung]

  *) htcacheclean: Fix list options "-a" and "-A".
     [Rainer Jung]
  *) mod_slotmem_shm: Fix mistaken reset of num_free for restored shm.
     [Jim Jagielski]

  *) mod_proxy: non-existance of byrequests is not an immediate error.
     [Jim Jagielski]
  *) mod_proxy_balancer: Improve output of balancer-manager (re: Drn,
     Dis, Ign, Stby). PR 52478 [Danijel <dt-ng rbfh de>]
  
  *) configure: Fix processing of --disable-FEATURE for various features.
     [Jeff Trawick]

  *) mod_dialup/mod_http: Prevent a crash in mod_dialup in case of internal
     redirect. PR 52230.

  *) various modules, rotatelogs: Replace use of apr_file_write() with
     apr_file_write_full() to prevent incomplete writes. PR 53131.
     [Nicolas Viennot <apache viennot biz>, Stefan Fritsch]

  *) ab: Support socket timeout (-s timeout).
     [Guido Serra <zeph fsfe org>]
  *) httxt2dbm: Correct length computation for the 'value' stored in the
     DBM file. PR 47650 [jon buckybox com]
Stefan Fritsch's avatar
Stefan Fritsch committed
  *) core: Be more correct about rejecting directives that cannot work in <If>
     sections. [Stefan Fritsch]

  *) core: Fix directives like LogLevel that need to know if they are invoked
     at virtual host context or in Directory/Files/Location/If sections to
     work properly in If sections that are not in a Directory/Files/Location.
     [Stefan Fritsch]
  *) mod_xml2enc: Fix problems with charset conversion altering the
     Content-Length. [Micha Lenk <micha lenk info>]

  *) ap_expr: Add req_novary function that allows HTTP header lookups
     without adding the name to the Vary header. [Stefan Fritsch]

  *) mod_slotmem_*: Add in new fgrab() function which forces a grab and
     slot allocation on a specified slot. Allow for clearing of inuse
     array. [Jim Jagielski]

  *) mod_proxy_ftp: Fix segfaults on IPv4 requests to hosts with DNS
     AAAA records. PR  40841. [Andrew Rucker Jones <arjones simultan
     dyndns org>, <ast domdv de>, Jim Jagielski]

  *) mod_auth_form: Make sure that get_notes_auth() sets the user as does
     get_form_auth() and get_session_auth(). Makes sure that REMOTE_USER
     does not vanish during mod_include driven subrequests. [Graham
     Leggett]

  *) mod_cache_disk: Resolve errors while revalidating disk-cached files on
     Windows ("...rename tempfile to datafile failed..."). PR 38827
     [Eric Covener]

  *) mod_proxy_balancer: Bring XML output up to date. [Jim Jagielski]

  *) htpasswd, htdbm: Optionally read passwords from stdin, as more
     secure alternative to -b.  PR 40243. [Adomas Paltanavicius <adomas
     paltanavicius gmail com>, Stefan Fritsch]

  *) htpasswd, htdbm: Add support for bcrypt algorithm (requires
     apr-util 1.5 or higher). PR 49288. [Stefan Fritsch]

  *) htpasswd, htdbm: Put full 48bit of entropy into salt, improve
     error handling. Add some of htpasswd's improvements to htdbm,
     e.g. warn if password is truncated by crypt(). [Stefan Fritsch]

  *) mod_auth_form: Support the expr parser in the
     AuthFormLoginRequiredLocation, AuthFormLoginSuccessLocation and
     AuthFormLogoutLocation directives. [Graham Leggett]

  *) mod_ssl: Add support for TLS-SRP (Secure Remote Password key exchange
     for TLS, RFC 5054). PR 51075. [Quinn Slack <sqs cs stanford edu>,
     Christophe Renou, Peter Sylvester]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_rewrite: Stop mergeing RewriteBase down to subdirectories
     unless new option 'RewriteOptions MergeBase' is configured.
     PR 53963. [Eric Covener]

  *) mod_header: Allow for exposure of loadavg and server load using new 
     format specifiers %l, %i, %b [Jim Jagielski]
  
Stefan Fritsch's avatar
Stefan Fritsch committed
  *) core: Make ap_regcomp() return AP_REG_ESPACE if out of memory.  Make
     ap_pregcomp() abort if out of memory. This raises the minimum PCRE
     requirement to version 6.0. [Stefan Fritsch]

  *) mod_proxy: Add ability to configure the sticky session separator.
     PR 53893. [<inu inusasha de>, Jim Jagielski]

  *) mod_dumpio: Correctly log large messages
     PR 54179 [Marek Wianecki <mieszek2 interia pl>]

  *) core: Don't fail at startup with AH00554 when Include points to 
     a directory without any wildcard character. [Eric Covener]

  *) core: Fail startup if the argument to ServerTokens is unrecognized.
     [Jackie Zhang  <jackie.qq.zhang gmail.com>]

  *) mod_log_forensic: Don't log a spurious "-" if a request has been rejected
     before mod_log_forensic could attach its id to it. [Stefan Fritsch]

Joe Orton's avatar
Joe Orton committed
  *) rotatelogs: Omit the second argument for the first invocation of
     a post-rotate program when -p is used, per the documentation.
     [Joe Orton]

  *) mod_session_dbd: fix a segmentation fault in the function dbd_remove.
Stefan Fritsch's avatar
Stefan Fritsch committed
     PR 53452. [<rebanerebane gmail com>, Reimo Rebane]
  *) core: Functions to provide server load values: ap_get_sload() and
     ap_get_loadavg(). [Jim Jagielski, Jan Kaluza <jkaluza redhat.com>,
     Jeff Trawick]

Joe Orton's avatar
Joe Orton committed
  *) mod_ldap: Fix regression in handling "server unavailable" errors on 
     Windows.  PR 54140.  [Eric Covener]
  *) syslog logging: Remove stray ", referer" at the end of some messages.
     [Jeff Trawick]

  *) "Iterate" directives: Report an error if no arguments are provided.
     [Jeff Trawick]

  *) mod_ssl: Change default for SSLCompression to off, as compression
     causes security issues in most setups. (The so called "CRIME" attack).
     [Stefan Fritsch]

  *) ab: add TLS1.1/TLS1.2 options to -f switch, and adapt output
     to more accurately report the negotiated protocol. PR 53916.
     [Nicolás Pernas Maradei <nico emutex com>, Kaspar Brand]

  *) core: ErrorDocument now works for requests without a Host header.
     PR 48357.  [Jeff Trawick]

  *) prefork: Avoid logging harmless errors during graceful stop.
     [Joe Orton, Jeff Trawick]
  *) mod_proxy: When concatting for PPR, avoid cases where we
     concat ".../" and "/..." to create "...//..." [Jim Jagielski]

  *) mod_cache: Wrong content type and character set when
     mod_cache serves stale content because of a proxy error. 
     PR 53539.  [Rainer Jung, Ruediger Pluem]

  *) mod_proxy_ajp: Fix crash in packet dump code when logging
     with LogLevel trace7 or trace8.  PR 53730.  [Rainer Jung]

  *) httpd.conf: Removed the configuration directives setting a bad_DNT
     environment introduced in 2.4.3. The actual directives are commented
     out in the default conf file.

  *) core: Apply length limit when logging Status header values.
     [Jeff Trawick, Chris Darroch]

  *) mod_proxy_balancer: The nonce is only derived from the UUID iff
     not set via the 'nonce' balancer param. [Jim Jagielski]

  *) mod_ssl: Match wildcard SSL certificate names in proxy mode.  
     PR 53006.  [Joe Orton]

  *) Windows: Fix output of -M, -L, and similar command-line options
     which display information about the server configuration.
     [Jeff Trawick]

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.3

Jim Jagielski's avatar
Jim Jagielski committed
  *) SECURITY: CVE-2012-3502  (cve.mitre.org)
     mod_proxy_ajp, mod_proxy_http: Fix an issue in back end
     connection closing which could lead to privacy issues due
     to a response mixup. PR 53727. [Rainer Jung]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) SECURITY: CVE-2012-2687 (cve.mitre.org)
Jeff Trawick's avatar
Jeff Trawick committed
     mod_negotiation: Escape filenames in variant list to prevent a
Stefan Fritsch's avatar
Stefan Fritsch committed
     possible XSS for a site where untrusted users can upload files to
     a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]

  *) mod_authnz_ldap: Don't try a potentially expensive nested groups
     search before exhausting all AuthLDAPGroupAttribute checks on the
Jim Jagielski's avatar
Jim Jagielski committed
     current group. PR 52464 [Eric Covener]
  *) mod_lua: Add new directive LuaAuthzProvider to allow implementing an
     authorization provider in lua. [Stefan Fritsch]

  *) core: Be less strict when checking whether Content-Type is set to 
     "application/x-www-form-urlencoded" when parsing POST data, 
     or we risk losing data with an appended charset. PR 53698
     [Petter Berntsen <petterb gmail.com>]

  *) httpd.conf: Added configuration directives to set a bad_DNT environment
     variable based on User-Agent and to remove the DNT header field from
     incoming requests when a match occurs. This currently has the effect of
     removing DNT from requests by MSIE 10.0 because it deliberately violates
     the current specification of DNT semantics for HTTP. [Roy T. Fielding]

  *) mod_socache_shmcb: Fix bus error due to a misalignment
     in some 32 bit builds, especially on Solaris Sparc.
     PR 53040.  [Rainer Jung]

Jim Jagielski's avatar
Jim Jagielski committed
  *) mod_cache: Set content type in case we return stale content.
     [Ruediger Pluem]

  *) Windows: Fix SSL failures on windows with AcceptFilter https none.
  *) ab: Fix read failure when targeting SSL server.  [Jeff Trawick]

  *) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
     - mod_auth_digest: shared memory file
  *) htpasswd: Use correct file mode for checking if file is writable.
     PR 45923. [Stefan Fritsch]

  *) mod_rewrite: Fix crash with dbd RewriteMaps. PR 53663. [Mikhail T.
     <mi apache aldan algebra com>]

  *) mod_ssl: Add new directive SSLCompression to disable TLS-level
     compression. PR 53219. [Björn Jacke <bjoern j3e de>, Stefan Fritsch]

Rainer Jung's avatar
Rainer Jung committed
  *) mod_lua: Add a few missing request_rec fields. Rename remote_ip to
     client_ip to match conn_rec. [Stefan Fritsch]

  *) mod_lua: Change prototype of vm_construct, to work around gcc bug which
     causes a segfault. PR 52779. [Dick Snippe <Dick Snippe tech omroep nl>]

Rainer Jung's avatar
Rainer Jung committed
  *) mpm_event: Don't count connections in lingering close state when
     calculating how many additional connections may be accepted.
     [Stefan Fritsch]

  *) mod_ssl: If exiting during initialization because of a fatal error,
     log a message to the main error log pointing to the appropriate
     virtual host error log. [Stefan Fritsch]

  *) mod_proxy_ajp: Reduce memory usage in case of many keep-alive requests on
     one connection. PR 52275. [Naohiro Ooiwa <naohiro ooiwa miraclelinux com>]

  *) mod_proxy_balancer: Restore balancing after a failed worker has
     recovered when using lbmethod_bybusyness.  PR 48735.  [Jeff Trawick]

  *) mod_setenvif: Compile some global regex only once during startup.
     This should save some memory, especially with .htaccess.
     [Stefan Fritsch]

Rainer Jung's avatar
 
Rainer Jung committed
  *) core: Add the port number to the vhost's name in the scoreboard.
     [Stefan Fritsch]

Joe Orton's avatar
Joe Orton committed
  *) mod_proxy: Fix ProxyPassReverse for balancer configurations.
Joe Orton's avatar
Joe Orton committed
     PR 45434.  [Joe Orton]
  *) mod_lua: Add the parsebody function for parsing POST data. PR 53064.
     [Daniel Gruno]

  *) apxs: Use LDFLAGS from config_vars.mk in addition to CFLAGS and CPPFLAGS.
     [Stefan Fritsch]

  *) mod_proxy: Fix memory leak or possible corruption in ProxyBlock
     implementation.  [Ruediger Pluem, Joe Orton]

  *) mod_proxy: Check hostname from request URI against ProxyBlock list,
     not forward proxy, if ProxyRemote* is configured.  [Joe Orton]

  *) mod_proxy_connect: Avoid DNS lookup on hostname from request URI 
     if ProxyRemote* is configured.  PR 43697.  [Joe Orton]

  *) mpm_event, mpm_worker: Remain active amidst prevalent child process
     resource shortages.  [Jeff Trawick]

  *) Add "strict" and "warnings" pragmas to Perl scripts.  [Rich Bowen]

  *) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
     - core: the scoreboard (ScoreBoardFile), pid file (PidFile), and
       mutexes (Mutex)
     [Jim Jagielski]

Joe Orton's avatar
Joe Orton committed
  *) ab: Fix bind() errors.  [Joe Orton]

  *) mpm_event: Don't do a blocking write when starting a lingering close
     from the listener thread. PR 52229. [Stefan Fritsch]

  *) mod_so: If a filename without slashes is specified for LoadFile or
     LoadModule and the file cannot be found in the server root directory,
     try to use the standard dlopen() search path. [Stefan Fritsch]

  *) mpm_event, mpm_worker: Fix cases where the spawn rate wasn't reduced
     after child process resource shortages.  [Jeff Trawick]

  *) mpm_prefork: Reduce spawn rate after a child process exits due to
     unexpected poll or accept failure.  [Jeff Trawick]

  *) core: Log value of Status header line in script responses rather
     than the fixed header name.  [Chris Darroch]

Jeff Trawick's avatar
Jeff Trawick committed
  *) mod_ssl: Fix handling of empty response from OCSP server.
     [Jim Meyering <meyering redhat.com>, Joe Orton]

Rainer Jung's avatar
Rainer Jung committed
  *) mpm_event: Fix handling of MaxConnectionsPerChild. [Stefan Fritsch]

  *) mod_authz_core: If an expression in "Require expr" returns denied and
     references %{REMOTE_USER}, trigger authentication and retry. PR 52892.
     [Stefan Fritsch]

  *) core: Always log if LimitRequestFieldSize triggers.  [Stefan Fritsch]

  *) mod_deflate: Skip compression if compression is enabled at SSL level.
     [Stefan Fritsch]

  *) core: Add missing HTTP status codes registered with IANA.
     [Julian Reschke <julian.reschke gmx.de>, Rainer Jung]

Joe Orton's avatar
Joe Orton committed
  *) mod_ldap: Treat the "server unavailable" condition as a transient
     error with all LDAP SDKs.  [Filip Valder <filip.valder vsb.cz>]

  *) core: Fix spurious "not allowed here" error returned when the Options 
     directive is used in .htaccess and "AllowOverride Options" (with no 
     specific options restricted) is configured.  PR 53444. [Eric Covener]

  *) mod_authz_core: Fix parsing of Require arguments in <AuthzProviderAlias>.
     PR 53048. [Stefan Fritsch]

  *) mod_log_config: Fix %{abc}C truncating cookie values at first "=".
     PR 53104. [Greg Ames]

  *) mod_ext_filter: Fix error_log spam when input filters are configured.  
     [Joe Orton]

  *) mod_rewrite: Add "AllowAnyURI" option. PR 52774. [Joe Orton]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) htdbm, htpasswd: Don't crash if crypt() fails (e.g. with FIPS enabled). 
     [Paul Wouters <pwouters redhat.com>, Joe Orton]

  *) core: Use a TLS 1.0 close_notify alert for internal dummy connection if
     the chosen listener is configured for https. [Joe Orton]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_proxy: Use the the same hostname for SNI as for the HTTP request when
     forwarding to SSL backends. PR 53134.
     [Michael Weiser <michael weiser.dinsnail.net>, Ruediger Pluem]

  *) mod_info: Display all registered providers. [Stefan Fritsch]

  *) mod_ssl: Send the error message for speaking http to an https port using
     HTTP/1.0 instead of HTTP/0.9, and omit the link that may be wrong when
     using SNI. PR 50823. [Stefan Fritsch]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) core: Fix segfault in logging if r->useragent_addr or c->client_addr is
Stefan Fritsch's avatar
Stefan Fritsch committed
     unset. PR 53265. [Stefan Fritsch]
Stefan Fritsch's avatar
Stefan Fritsch committed

  *) log_server_status: Bring Perl style forward to the present, use
     standard modules, update for new format of server-status output.
     PR 45424. [Richard Bowen, Dave Brondsema, and others]

Joe Orton's avatar
Joe Orton committed
  *) mod_sed, mod_log_debug, mod_rewrite: Symbol namespace cleanups. 
     [Joe Orton, André Malo]
  *) core: Prevent "httpd -k restart" from killing server in presence of
     config error. [Joe Orton]

  *) mod_proxy_fcgi: If there is an error reading the headers from the
     backend, send an error to the client. PR 52879. [Stefan Fritsch]

  *) SECURITY: CVE-2012-0883 (cve.mitre.org)
     envvars: Fix insecure handling of LD_LIBRARY_PATH that could lead to the
     current working directory to be searched for DSOs. [Stefan Fritsch]
Stefan Fritsch's avatar
Stefan Fritsch committed

  *) mod_slotmem_shm: Honor DefaultRuntimeDir [Jim Jagielski]

  *) mod_ssl: Fix crash with threaded MPMs due to race condition when
     initializing EC temporary keys. [Stefan Fritsch]

  *) mod_rewrite: Fix RewriteCond integer checks to be parsed correctly.
     PR 53023. [Axel Reinhold <apache freakout.de>, André Malo]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_proxy: Add the forcerecovery balancer parameter that determines if
     recovery for balancer workers is enforced. [Ruediger Pluem]

  *) Fix MPM DSO load failure on AIX.  [Jeff Trawick]

  *) mod_proxy: Correctly set up reverse proxy worker. PR 52935.
     [Petter Berntsen <petterb gmail.com>]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_sed: Don't define PATH_MAX to a potentially undefined value, causing
     compile problems on GNU hurd. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) core: Add ap_runtime_dir_relative() and DefaultRuntimeDir.
     [Jeff Trawick]

Graham Leggett's avatar
Graham Leggett committed
  *) core: Fix breakage of Listen directives with MPMs that use a
     per-directory config. PR 52904. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) core: Disallow directives in AllowOverrideList which are only allowed
     in VirtualHost or server context. These are usually not prepared to be
     called in .htaccess files. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) core: In AllowOverrideList, do not allow 'None' together with other
     directives. PR 52823. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_slotmem_shm: Support DEFAULT_REL_RUNTIMEDIR for file-based shm.
     [Jim Jagielski]

Eric Covener's avatar
Eric Covener committed
  *) core: Fix merging of AllowOverrideList and ContentDigest.
     [Stefan Fritsch]

Eric Covener's avatar
Eric Covener committed
  *) mod_request: Fix validation of the KeptBodySize argument so it
     doesn't always throw a configuration error. PR 52981 [Eric Covener]

  *) core: Add filesystem paths to access denied / access failed messages
     AH00035 and AH00036. [Eric Covener]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_dumpio: Properly handle errors from subsequent input filters.
     PR 52914. [Stefan Fritsch]
Joe Orton's avatar
Joe Orton committed
  *) Unix MPMs: Fix small memory leak in parent process if connect()
     failed when waking up children.  [Joe Orton]

  *) "DirectoryIndex disabled" now undoes DirectoryIndex settings in
     the current configuration section, not just previous config sections.
Stefan Fritsch's avatar
Stefan Fritsch committed
     PR 52845. [Eric Covener]
  *) mod_xml2enc: Fix broken handling of EOS buckets which could lead to
     response headers not being sent. PR 52766. [Stefan Fritsch]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_ssl: Properly free the GENERAL_NAMEs. PR 32652. [Kaspar Brand]
Jim Jagielski's avatar
Jim Jagielski committed

  *) core: Check during config test that directories for the access
Stefan Fritsch's avatar
Stefan Fritsch committed
     logs actually exist. PR 29941. [Stefan Fritsch]
Jim Jagielski's avatar
Jim Jagielski committed

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_xml2enc, mod_proxy_html: Enable per-module loglevels.
     [Stefan Fritsch]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_filter: Fix segfault with AddOutputFilterByType. PR 52755.
     [Stefan Fritsch]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_session: Sessions are encoded as application/x-www-form-urlencoded
     strings, however we do not handle the encoding of spaces properly.
     Fixed. [Graham Leggett]
Graham Leggett's avatar
Graham Leggett committed

  *) Configuration: Example in comment should use a path consistent
     with the default configuration. PR 52715.
     [Rich Bowen, Jens Schleusener, Rainer Jung]

  *) Configuration: Switch documentation links from trunk to 2.4.
     [Rainer Jung]

  *) configure: Fix out of tree build using apr and apr-util in srclib.
     [Rainer Jung]

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.4.1

  *) SECURITY: CVE-2012-0053 (cve.mitre.org)
     Fix an issue in error responses that could expose "httpOnly" cookies
     when no custom ErrorDocument is specified for status code 400.  
     [Eric Covener]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_proxy_balancer: Fix crash on Windows. PR 52402 [Mladen Turk]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) core: Check during configtest that the directories for error logs exist.
     PR 29941 [Stefan Fritsch]

  *) Core configuration: add AllowOverride option to treat syntax
     errors in .htaccess as non-fatal. PR 52439 [Nick Kew, Jim Jagielski]

Joe Orton's avatar
Joe Orton committed
  *) core: Fix memory consumption in core output filter with streaming
     bucket types like CGI or PIPE.  [Joe Orton, Stefan Fritsch]

  *) configure: Disable modules at configure time if a prerequisite module
     is not enabled. PR 52487. [Stefan Fritsch]

  *) Rewrite and proxy now decline what they don't support rather
     than fail the request. [Joe Orton]
Rainer Jung's avatar
Rainer Jung committed
  *) Fix building against external apr plus apr-util if apr is not installed
Rainer Jung's avatar
Rainer Jung committed
     in a system default path. [Rainer Jung]

  *) Doxygen fixes and improvements. [Joe Orton, Igor Galić]

  *) core: Fix building against PCRE 8.30 by switching from the obsolete
     pcre_info() to pcre_fullinfo(). PR 52623 [Ruediger Pluem, Rainer Jung]

Changes with Apache 2.4.0

  *) SECURITY: CVE-2012-0031 (cve.mitre.org)
     Fix scoreboard issue which could allow an unprivileged child process
Jeff Trawick's avatar
Jeff Trawick committed
     to cause the parent to crash at shutdown rather than terminate
  *) mod_ssl: Fix compilation with xlc on AIX. PR 52394. [Stefan Fritsch]

  *) SECURITY: CVE-2012-0021 (cve.mitre.org)
     mod_log_config: Fix segfault (crash) when the '%{cookiename}C' log format
     string is in use and a client sends a nameless, valueless cookie, causing
     a denial of service. The issue existed since version 2.2.17 and 2.3.3.
Stefan Fritsch's avatar
Stefan Fritsch committed
     PR 52256.  [Rainer Canavan <rainer-apache 7val com>]
Stefan Fritsch's avatar
Stefan Fritsch committed

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: when compiled against OpenSSL 1.0.1 or later, allow explicit
     control of TLSv1.1 and TLSv1.2 through the SSLProtocol directive.
     [Kaspar Brand]

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: set OPENSSL_NO_SSL_INTERN when compiling against OpenSSL 1.0.1
     or later, to improve binary compatibility with future OpenSSL releases.
     [Kaspar Brand]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_mime: Don't arbitrarily bypass AddOutputFilter during a ProxyPass,
     but then allow AddOutputFilter during a RewriteRule [P]. Make mod_mime
     behave identically in both cases. PR52342. [Graham Leggett]

Graham Leggett's avatar
Graham Leggett committed
  *) Move ab, logresolve, httxt2dbm and apxs to bin from sbin, along with
     corresponding man pages. [Graham Leggett]

Graham Leggett's avatar
Graham Leggett committed
  *) Distinguish properly between the bindir and sbindir directories when
     installing binaries. Previously all binaries were silently installed to
     sbindir, whether they were system administration commands or not.
     [Graham Leggett]
Changes with Apache 2.3.16
  *) SECURITY: CVE-2011-4317 (cve.mitre.org)
     Resolve additional cases of URL rewriting with ProxyPassMatch or
     RewriteRule, where particular request-URIs could result in undesired
     backend network exposure in some configurations.
     [Joe Orton]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) core: Limit line length in .htaccess to 8K like in 2.2.x, to avoid
     additional DoS potential. [Stefan Fritsch]

  *) core, all modules: Add unique tag to most error log messages. [Stefan
     Fritsch]

  *) mod_socache_memcache: Change provider name from "mc" to "memcache" to
     match module name. [Stefan Fritsch]

  *) mod_slotmem_shm: Change provider name from "shared" to "shm" to match
     module name. [Stefan Fritsch]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_ldap: Fix segfault with Solaris LDAP when enabling ldaps. This
     requires an apr-util fix in which is available in apr-util >= 1.4.0.
     PR 42682. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_rewrite: Add the AllowNoSlash RewriteOption, which makes it possible
     for RewriteRules to be placed in .htaccess files that match the directory
     with no trailing slash. PR 48304.
     [Matthew Byng-Maddick <matthew byng-maddick bbc.co.uk>]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_session_crypto: Add a SessionCryptoPassphraseFile directive so that
     the administrator can hide the keys from the configuration. [Graham
     Leggett]

Graham Leggett's avatar
Graham Leggett committed
  *) Introduce a per request version of the remote IP address, which can be
     optionally modified by a module when the effective IP of the client
     is not the same as the real IP of the client (such as a load balancer).
     Introduce a per connection "peer_ip" and a per request "client_ip" to
     distinguish between the raw IP address of the connection and the effective
     IP address of the request. [Graham Leggett]

Jim Jagielski's avatar
Jim Jagielski committed
  *) ap_pass_brigade_fchk() function added. [Jim Jagielski]

  *) core: Pass ap_errorlog_info struct to error log hook. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_cache_disk: Make sure we check return codes on all writes and
     attempts to close, and clean up after ourselves in these cases.
     PR43589. [Graham Leggett]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_cache_disk: Remove the unnecessary intermediate brigade while
     writing to disk. Fixes a problem where mod_disk_cache was leaving
     buckets in the intermediate brigade and not passing them to out on
     exit. [Florian S. <f_los_ch yahoo.com>, Graham Leggett]
Graham Leggett's avatar
Graham Leggett committed

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: use a shorter setting for SSLCipherSuite in the default
     default configuration file, and add some more information about
     configuring a speed-optimized alternative.
     [Kaspar Brand]

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: drop support for the SSLv2 protocol. [Kaspar Brand]

Eric Covener's avatar
Eric Covener committed
  *) mod_lua: Stop losing track of all but the most specific LuaHook* directives
     when multiple per-directory config sections are used.  Adds LuaInherit 
     directive to control how parent sections are merged.  [Eric Covener]

Jeff Trawick's avatar
Jeff Trawick committed
  *) Server directive display (-L): Include directives of DSOs.
     [Jeff Trawick]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_cache: Make sure we merge headers correctly when we handle a
     non cacheable conditional response. PR52120. [Graham Leggett]

Rainer Jung's avatar
Rainer Jung committed
  *) Pre GA removal of components that will not be included:
     - mod_noloris was superseded by mod_reqtimeout
  *) core: Set MaxMemFree 2048 by default. [Stefan Fritsch]

  *) mpm_event: Fix assertion failure during very high load. [Stefan Fritsch]

  *) configure: Additional modules loaded by default: mod_headers.
     Modules moved from module set "few" to "most" and no longer loaded
     by default: mod_actions, mod_allowmethods, mod_auth_form, mod_buffer,
     mod_cgi(d), mod_include, mod_negotiation, mod_ratelimit, mod_request,
     mod_userdir. [Rainer Jung]

  *) mod_lua: Use the right lua scope when used as a hook. [Rainer Jung]

  *) configure: Only load the really imporant modules (i.e. those enabled by
     the 'few' selection) by default. Don't handle modules enabled with
     --enable-foo specially. [Stefan Fritsch]

  *) end-generation hook: Fix false notification of end-of-generation for
     temporary intervals with no active MPM children.  [Jeff Trawick]

  *) mod_ssl: Add support for configuring persistent TLS session ticket
     encryption/decryption keys (useful for clustered environments).
     [Paul Querna, Kaspar Brand]
  *) mod_usertrack: Use random value instead of remote IP address.
     [Stefan Fritsch]
Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.3.15

  *) SECURITY: CVE-2011-3348 (cve.mitre.org)
     mod_proxy_ajp: Respond with HTTP_NOT_IMPLEMENTED when the method is not
     recognized.  [Jean-Frederic Clere]

  *) SECURITY: CVE-2011-3192 (cve.mitre.org)
     core: Fix handling of byte-range requests to use less memory, to avoid
     denial of service. If the sum of all ranges in a request is larger than
     the original file, ignore the ranges and send the complete file.
     PR 51714. [Stefan Fritsch, Jim Jagielski, Ruediger Pluem, Eric Covener,
     <lowprio20 gmail.com>]
  *) SECURITY: CVE-2011-3607 (cve.mitre.org)
     core: Fix integer overflow in ap_pregsub. This can be triggered e.g.
     with mod_setenvif via a malicious .htaccess. [Stefan Fritsch]

  *) SECURITY: CVE-2011-3368 (cve.mitre.org)
     Reject requests where the request-URI does not match the HTTP
     specification, preventing unexpected expansion of target URLs in
     some reverse proxy configurations.  [Joe Orton]

  *) configure: Load all modules in the generated default configuration
     when using --enable-load-all-modules. [Rainer Jung]

  *) mod_reqtimeout: Change the default to set some reasonable timeout
     values. [Stefan Fritsch]

  *) core, mod_dav_fs: Change default ETag to be "size mtime", i.e. remove
     the inode. PR 49623. [Stefan Fritsch]

  *) mod_lua: Expose SSL variables via r:ssl_var_lookup().  [Eric Covener]

  *) mod_lua: LuaHook{AccessChecker,AuthChecker,CheckUserID,TranslateName}
     can now additionally be run as "early" or "late" relative to other modules.
     [Eric Covener]

  *) configure: By default, only load those modules that are either required
     or explicitly selected by a configure --enable-foo argument. The
     LoadModule statements for modules enabled by --enable-mods-shared=most
     and friends will be commented out. [Stefan Fritsch]

  *) mod_lua: Prevent early Lua hooks (LuaHookTranslateName and 
     LuaHookQuickHandler) from being configured in <Directory>, <Files>, 
     and htaccess where the configuration would have been ignored.
     [Eric Covener]

  *) mod_lua: Resolve "attempt to index local 'r' (a userdata value)" errors
     in LuaMapHandler scripts [Eric Covener]

  *) mod_log_debug: Rename optional argument from if= to expr=, to be more
     in line with other config directives. [Stefan Fritsch]

  *) mod_headers: Require an expression to be specified with expr=, to be more
     in line with other config directives. [Stefan Fritsch]

  *) mod_substitute: To prevent overboarding memory usage, limit line length
     to 1MB. [Stefan Fritsch]

  *) mod_lua: Make the query string (r.args) writable. [Eric Covener]

  *) mod_include: Add support for application/x-www-form-urlencoded encoding
     and decoding. [Graham Leggett]

  *) rotatelogs: Add -c option to force logfile creation in every rotation 
     interval, even if empty.  [Jan Kaluža <jkaluza redhat.com>]
 
  *) core: Limit ap_pregsub() to 64K, add ap_pregsub_ex() for longer strings.
     [Stefan Fritsch]

  *) mod_session_crypto: Refactor to support the new apr_crypto API.
     [Graham Leggett]

  *) http: Add missing Location header if local URL-path is used as
     ErrorDocument for 30x. [Stefan Fritsch]

  *) mod_buffer: Make sure we step down for subrequests, but not for internal
     redirects triggered by mod_rewrite. [Graham Leggett]

  *) mod_lua: add r:construct_url as a wrapper for ap_construct_url.
     [Eric Covener]
 
  *) mod_remote_ip: Fix configuration of internal proxies. PR 49272.
     [Jim Riggs <jim riggs me>]

William A. Rowe Jr's avatar
 
William A. Rowe Jr committed
  *) mpm_winnt: Handle AcceptFilter 'none' mode correctly; resolve specific
     server IP endpoint and remote client IP upon connection.  [William Rowe]

  *) mod_setenvif: Remove OID match which is obsoleted by SetEnvIfExpr with
     PeerExtList(). [Stefan Fritsch]

  *) mpm_prefork, mpm_worker, mpm_event: If a child is created just before
     graceful restart and then exits because of a missing lock file, don't
     shutdown the whole server. PR 39311. [Shawn Michael
     <smichael rightnow com>]

  *) mpm_event: Check the return value from ap_run_create_connection.
     PR 41194. [Davi Arnaut]
  *) mod_mime_magic: Add signatures for PNG and SWF to the example config.
     PR 48352. [Jeremy Wagner-Kaiser <jwagner-kaiser adknowledge com>]
  *) core, unixd: Add -D DUMP_RUN_CFG option to dump some configuration items
     from the parsed (or default) config. This is useful for init scripts that
     need to setup temporary directories and permissions. [Stefan Fritsch]

  *) core, mod_actions, mod_asis: Downgrade error log messages which accompany
     a 404 request status from loglevel error to info. PR 35768. [Stefan
  *) core: Fix hook sorting with Perl modules. PR 45076. [Torsten Foertsch
  *) core: Enforce LimitRequestFieldSize after multiple headers with the same
     name have been merged. [Stefan Fritsch]

  *) mod_ssl: If MaxMemFree is set, ask OpenSSL >= 1.0.0 to reduce memory
     usage.  PR 51618. [Cristian Rodríguez <crrodriguez opensuse org>,
  *) mod_ssl: At startup, when checking a server certificate whether it
     matches the configured ServerName, also take dNSName entries in the
     subjectAltName extension into account. PR 32652, PR 47051. [Kaspar Brand]

  *) mod_substitute: Reduce memory usage and copying of data. PR 50559.
     [Stefan Fritsch]

  *) mod_ssl/proxy: enable the SNI extension for backend TLS connections
     [Kaspar Brand]

  *) Add wrappers for malloc, calloc, realloc that check for out of memory
     situations and use them in many places. PR 51568, PR 51569, PR 51571.
     [Stefan Fritsch]

  *) Fix cross-compilation of mod_cgi/mod_cgid when APR_HAVE_STRUCT_RLIMIT is 
     false but RLIMIT_* are defined.  PR51371. [Eric Covener]

  *) core: Correctly obey ServerName / ServerAlias if the Host header from the
     request matches the VirtualHost address.
     PR 51709. [Micha Lenk <micha lenk.info>]

  *) mod_unique_id: Use random number generator to initialize counter.
     PR 45110. [Stefan Fritsch]

  *) core: Add convenience API for apr_random. [Stefan Fritsch]

  *) core: Add MaxRangeOverlaps and MaxRangeReversals directives to control
     the number of overlapping and reversing ranges (respectively) permitted
     before returning the entire resource, with a default limit of 20.
     [Jim Jagielski]

  *) mod_ldap: Optional function uldap_ssl_supported(r) always returned false
     if called from a virtual host with mod_ldap directives in it.  Did not
     affect mod_authnz_ldap's usage of mod_ldap.  [Eric Covener]

  *) mod_filter: Instead of dropping the Accept-Ranges header when a filter
     registered with AP_FILTER_PROTO_NO_BYTERANGE is present,
     set the header value to "none". [Eric Covener, Ruediger Pluem]

  *) core: Allow MaxRanges none|unlimited|default and set 'Accept-Ranges: none'
     in the case Ranges are being ignored with MaxRanges none.
     [Eric Covener]

  *) mod_ssl: revamp CRL-based revocation checking when validating
     certificates of clients or proxied servers. Completely delegate
     CRL processing to OpenSSL, and add a new [Proxy]CARevocationCheck
     directive for controlling the revocation checking mode. [Kaspar Brand]

  *) core: Add MaxRanges directive to control the number of ranges permitted
     before returning the entire resource, with a default limit of 200.
  *) mod_cache: Ensure that CacheDisable can correctly appear within
     a LocationMatch. [Graham Leggett]

  *) mod_cache: Fix the moving of the CACHE filter, which erroneously
     stood down if the original filter was not added by configuration.
     [Graham Leggett]

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: improve certificate error logging. PR 47408. [Kaspar Brand]

  *) mod_authz_groupfile: Increase length limit of lines in the group file to
     16MB. PR 43084. [Stefan Fritsch]

  *) core: Increase length limit of lines in the configuration file to 16MB.
     PR 45888. PR 50824. [Stefan Fritsch]

  *) core: Add API for resizable buffers. [Stefan Fritsch]

  *) mod_ldap: Enable LDAPConnectionTimeout for LDAP toolkits that have
     LDAP_OPT_CONNECT_TIMEOUT instead of LDAP_OPT_NETWORK_TIMEOUT, such
     as Tivoli Directory Server 6.3 and later. [Eric Covener]

  *) mod_ldap: Change default number of retries from 10 to 3, and add
     an LDAPRetries and LDAPRetryDelay directives. [Eric Covener]

  *) mod_authnz_ldap: Don't retry during authentication, because this just
     multiplies the ample retries already being done by mod_ldap. [Eric Covener]

  *) configure: Allow to explicitly disable modules even with module selection
     'reallyall'. [Stefan Fritsch]

  *) mod_rewrite: Check validity of each internal (int:) RewriteMap even if the
     RewriteEngine is disabled in server context, avoiding a crash while
     referencing the invalid int: map at runtime. PR 50994.
     [Ben Noordhuis <info noordhuis nl>]
  *) mod_ssl, configure: require OpenSSL 0.9.7 or later. [Kaspar Brand]

  *) mod_ssl: remove ssl_toolkit_compat layer. [Kaspar Brand]

  *) mod_ssl, configure, ab: drop support for RSA BSAFE SSL-C toolkit.
     [Kaspar Brand]

  *) mod_usertrack: Run mod_usertrack earlier in the fixups hook to ensure the
     cookie is set when modules such as mod_rewrite trigger a redirect. Also
     use r->err_headers_out for the cookie, for the same reason.  PR29755.
     [Sami J. Mäkinen <sjm almamedia fi>, Eric Covener]

  *) mod_proxy_http, mod_proxy_connect: Add 'proxy-status' and
     'proxy-source-port' request notes for logging. PR 30195. [Stefan Fritsch]

  *) configure: Enable ldap modules in 'all' and 'most' selections if ldap
     is compiled into apr-util. [Stefan Fritsch]

  *) core: Add ap_check_cmd_context()-check if a command is executed in
     .htaccess file. [Stefan Fritsch]

  *) mod_deflate: Fix endless loop if first bucket is metadata. PR 51590.
     [Torsten Foertsch <torsten foertsch gmx net>]
  *) mod_authn_socache: Fix to work in .htaccess if not configured anywhere
     in httpd.conf, and introduce an AuthnCacheEnable directive.
     PR 51991 [Nick Kew]

Nick Kew's avatar
Nick Kew committed
  *) mod_xml2enc: new (formerly third-party) module supporting
     internationalisation for filters via smart charset sniffing
     and conversion. [Nick Kew]

  *) mod_proxy_html: new (formerly third-party) module to fix up
     HTML links in a reverse proxy situation, where a backend
     generates URLs that are not resolvable by Clients. [Nick Kew]

Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.3.14

  *) mod_proxy_ajp: Improve trace logging.  [Rainer Jung]

  *) mod_proxy_ajp: Respect "reuse" flag in END_REPONSE packets.
     [Rainer Jung]

  *) mod_proxy: enable absolute URLs to be rewritten with ProxyPassReverse,
     e.g. to reverse proxy "Location: https://other-internal-server/login"
     [Nick Kew]

  *) prefork, worker, event: Make sure crashes are logged to the error log if
     httpd has already detached from the console. [Stefan Fritsch]

  *) prefork, worker, event: Reduce period during startup/restart where a
     successive signal may be lost. PR 43696. [Arun Bhalla <arun shme net>]

  *) mod_allowmethods: Correct Merging of "reset" and do not allow an
     empty parameter list for the AllowMethods directive. [Rainer Jung]

  *) configure: Update selection of modules for 'all' and 'most'. 'all' will
     now enable all modules except for example and test modules. Make the
     selection for 'most' more useful (including ssl and proxy). Both 'all'
     and 'most' will now disable modules if dependencies are missing instead
     of aborting. If a specific module is requested with --enable-XXX=yes,
     missing dependencies will still cause configure to exit with an error.
     [Stefan Fritsch]

  *) mod_ldap: Revert the integration of apr-ldap as ap_ldap which was done
     in 2.3.13. [Stefan Fritsch]

  *) core: For '*' or '_default_' vhosts, use a wildcard address of any
     address family, rather than IPv4 only.  [Joe Orton]

  *) core, mod_rewrite, mod_ssl, mod_nw_ssl: Make the SERVER_NAME variable
     include [ ] for literal IPv6 addresses, as mandated by RFC 3875.
     PR 26005. [Stefan Fritsch]

  *) mod_negotiation: Fix parsing of Content-Length in type maps. PR 42203.
     [Nagae Hidetake <nagae eagan jp>]

  *) core: Add more logging to ap_scan_script_header_err* functions. Add
     ap_scan_script_header_err*_ex functions that take a module index for
     logging.
     mod_cgi, mod_cgid, mod_proxy_fcgi, mod_proxy_scgi, mod_isapi: Use the
     new functions in order to make logging configurable per-module.
     [Stefan Fritsch]

  *) mod_dir: Add DirectoryIndexRedirect to send an external redirect to
     the proper index.  [Eric Covener]

  *) mod_deflate: Don't try to compress requests with a zero sized body.
     PR 51350. [Stefan Fritsch]

Jeff Trawick's avatar
Jeff Trawick committed
  *) core: Fix startup on IPv6-only systems. PR 50592. [Joe Orton,
     <root linkage white-void net>]

  *) suexec: Add environment variables CONTEXT_DOCUMENT_ROOT, CONTEXT_PREFIX,
     REDIRECT_ERROR_NOTES, REDIRECT_SCRIPT_FILENAME, REQUEST_SCHEME to the
     whitelist in suexec. PR 51499. [Graham Laverty <graham reg ca>,
     Stefan Fritsch]

  *) mod_rewrite: Fix regexp RewriteCond with NoCase. [Stefan Fritsch]